`saw watch`¶

Put saw watch in place. From then on, and after every login, it looks at what is running and ends code saw has identified. It never asks for a password, and it writes what it saw to its own record so a later pass can tell something that has come back from something new. It stays in place until you take it back with saw watch stop.

saw watch [--no-stream]
saw watch status [--no-stream]
saw watch stop [--no-stream]

It is deliberately narrower than saw harden. Harden runs with you present: it ends everything it grades, and it can ask for privilege to reach what it otherwise could not. This one is built to run with nobody watching, so it holds a higher bar before it ends anything, and it leaves the rest for you.

What it will and will not end¶


Code the tool has identified	ended
Code that only looks wrong	left alone, and recorded
Anything needing a password	left alone — it will not prompt where nobody can answer

Whatever it declines is not forgotten. Run saw harden when you are at the machine and it will act on what this pass would not.

What it tells you¶

One line about where this machine stands:

nothing is running code it should not;
code was running and has been stopped;
something that was stopped here before is running again — the sentence that matters, and the point at which to run saw harden, then saw audit to find what brings it back;
something is running that this machine cannot identify;
something could not be stopped.

It names no paths and no process numbers. If a pass could not finish what it started, or could not examine what is running, it says so rather than reporting a clean machine.

It tells you where you will notice. A desktop notification appears when it stops code, when code it stopped before comes back, when code could not be stopped, and when it has not been able to check the machine for a while. Code that came back, and code that could not be stopped, are repeated every hour until they are dealt with: run saw harden, and when code came back, run saw audit to find what brings it back. Once a day it sends a short report, on quiet days too, so a day without one is worth a saw watch status.

While something is not dealt with, every other saw command prints one line saying so, whether or not a notification was shown: code that came back, code that could not be stopped, or saw watch no longer running. saw watch status lists the same, with what happened since the last report and any notifications that could not be sent, and saw audit reports code that came back or could not be stopped.

saw watch sends one notification when you set it up, to show where they will appear. On macOS they come from Script Editor; if none appears, allow notifications for Script Editor in System Settings. On Linux they go to your desktop's notification service. A notification that cannot be shown is tried again later.

When it runs by itself¶

saw harden puts this in place as part of hardening a machine, and saw watch is how you ask for it on its own, check it, or change your mind about it.

saw watch puts the pass in place — starting with your session, and started again if it ever stops. It says whether that is in force now or from your next login; where the system will not start it immediately, the arrangement is still made and takes effect then. It keeps doing that until saw watch stop. Asking twice changes nothing and says so.

What it runs is fixed. There is nothing in it to configure, and therefore nothing in it for anyone else to point somewhere else; if it is not exactly what saw wrote, running saw watch again puts it back and tells you it had been changed. Anything else found under that name is left alone — stopping removes saw's own work and nothing else.

A quiet pass sends nothing; the daily report says nothing was running that should not be.

The record¶

The pass keeps a small record under your state directory of the code it has seen: when each was first and last seen, how often, and whether it was ended. That is what lets it say again rather than repeating the same alarm every pass.

The record holds no code — the payload itself is never written to it, because a command line can carry your own secrets and that file outlives the run. Deleting the record costs nothing but the history: the next pass still examines every process on its own evidence, so nothing can be hidden from this command by editing or removing it.

Platforms¶

macOS and Linux. On macOS it is a login item; on Linux, a user service. Either way it starts with your session and is started again if it stops, and saw watch stop removes it.

Elsewhere the command says it could not arrange it, rather than reporting a machine as watched.

saw watch¶